Arista EOS: Authorization bypass via spoofed device profile in 802.1X
Summary
Arista EOS switches with 802.1X and DHCP device profiling enabled can record a spoofed device profile when they receive a crafted DHCP packet. A network-adjacent attacker can thereby gain unauthorized access to a network segment with elevated privileges. The attack requires a foothold on the LAN or a switch port and the specific 802.1X and DHCP profiling configuration. Sources conflict on the required privileges, which the advisory must clarify.
Affected
- Arista EOS 4.31.2F to before 4.32.0F
- Arista EOS 4.32.0F to before 4.33.0F
- Arista EOS 4.33.0F through 4.33.9M
- Arista EOS 4.34.0F through 4.34.7M
- Arista EOS 4.35.0F through 4.35.5M
- Arista EOS 4.36.0F through 4.36.2F
- Exposure requires 802.1X with DHCP device profiling (radius av-pair dhcp options).
- Default configuration: unaffected.
Fixed in
Unknown. Check the Arista advisory 25039-security-advisory-0217 for fixed releases.
Workaround
Unknown from the sources checked. Possible measures, not confirmed by the vendor:
- Disable DHCP-based device profiling under 802.1X if NAC does not depend on it.
- Enable DHCP snooping on user VLANs; effect on this specific path is unconfirmed.
Exploitation
No known in-the-wild exploitation or public proof of concept at the time of research. Not listed in CISA KEV according to a third-party tracker.
Our recommendation
- Inventory Arista EOS devices and their exact versions, including any running EOS 4.31, which is end of support.
- Check whether 802.1X with DHCP profiling is enabled on each switch.
- Read the Arista advisory for fixed versions and mitigations, then plan upgrades.
- Where NAC segmentation depends on device profiles, review the policy until the patch is applied.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-120977 www.cve.org
- Arista Security Advisory 0217 www.arista.com
- Arista EOS end of support www.arista.com
- Strix CVE tracker www.strix.ai
- DHCP snooping STIG finding www.stigviewer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:08.
Original description (NVD)
On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.